API access control strategies beyond JWT bearer tokens
summary
Explains concrete fixes for bearer token weaknesses and what to change now: adopt policy-based access control so services consult a central policy engine instead of hardcoding rules, switch to sender-constraint tokens (certificate‑bound via mTLS RFC8705 or DPoP RFC9449) to stop token replay, and implement the phantom token pattern that issues opaque external tokens and translates them to short‑lived internal JWT transaction tokens at the gateway. Also enforce issuer, audience and scope checks and validate proofs at the service layer.
AI-written summary · about
chapters (12)
- 0:00API access control beyond JWT
- 1:29Policy-based access control
- 2:11Risks of JWT bearer tokens
- 3:12Sender-constrained tokens with mTLS
- 5:44Certificate-bound tokens
- 6:27Proof of possession with DEOP
- 7:51Mitigating token replay
- 9:15JWTs for identity transport
- 10:38Risks of sensitive JWT data
- 11:19Improved token architecture
- 12:21Phantom token pattern
- 13:25Key takeaways
related talks
53mCommon API Security Pitfalls
46mBearer of Good News
01h 02mOAuth in 2021 – What’s up?
55mSupercharging OAuth 2.0 security
56mSecuring an API Ecosystem with OAuth 2 0
01h 00mSupercharging OAuth 2.0 Security
50mCommon API Security Pitfalls
26mImproving authentication policy enforcement for government resources